Apologies if this is a dumb question, and maybe it applies to other services I may already use, but:
What if Unison language and the Cloud have a vulnerability. Would you suddenly have a large network of services that could be readily exploited? This sort of "infrastructure monoculture" situation gives me the heebie-jeebies, but I'm admittedly pretty dumb when it comes to security.
I imagine that with my Google Cloud Run instance running who-knows-what language on maybe some framework, the opportunities to zero in on an exploit are fewer than when an attacker can know exactly what's running, what it's running on, and perhaps even have the ability to enumerate to find instances off of pro plans since they may often use auto-generated names from hyphen-separated common words. If the sandboxing of instances is poor, it seems like it could be a huge problem.
Again, I have no idea what I'm talking about. Mostly curious to learn more, not criticize.
This problem exists with all shared code. Shared code, shared fate.
You hope that with more eyes on a library, it'll be more secure. It may also mean vulnerabilities have a higher blast radius. You have to choose where you want to lie on the balance.
Spectre and Log4J - problems on widely deployed tech (Intel CPUs, Java services).
Very good point at the end; the lower level you go, the broader (and likely more severe) your vulnerabilities will be. I suppose in this case my concerns aren't warranted, or at least not worth placing before more immediate and obvious concerns. i.e., I could write shitty code a lot more easily than Unison could compromise their language and infrastructure.
What if Unison language and the Cloud have a vulnerability. Would you suddenly have a large network of services that could be readily exploited? This sort of "infrastructure monoculture" situation gives me the heebie-jeebies, but I'm admittedly pretty dumb when it comes to security.
I imagine that with my Google Cloud Run instance running who-knows-what language on maybe some framework, the opportunities to zero in on an exploit are fewer than when an attacker can know exactly what's running, what it's running on, and perhaps even have the ability to enumerate to find instances off of pro plans since they may often use auto-generated names from hyphen-separated common words. If the sandboxing of instances is poor, it seems like it could be a huge problem.
Again, I have no idea what I'm talking about. Mostly curious to learn more, not criticize.